Adding MX-67 inside the network and declare vlans

[Tarmahmood1]

Hello, 

Got a request from client that, if he has spare MX-67 applaince and wants to keep next to his desk, meaning the uplink will be switch and he will configure some vlans on it which will be different from MX-95. At uplink side we have MX-95 which has DHCP and vlans configured.

I have never thought about such setup. Is it worth to test to have MX-67 and declare some VLANs which will not be part of entire network. Is it really feasible or worth to test. any idea? . as of now i dont know what his intention are...

 

[Main10ence]

Hello @Tarmahmood1,

The topology that you have laid out is feasible. The VLANs configured on the MX67 will not compete with the VLANs on the MX95.

The egress for the MX67 will be a VLN ON THE MX95. 

I hope that this makes sense. Let me know if you have any questions.

[alemabrahao]

I think you should first try to understand what his need is? It is possible to do this, but we need more details to see if it is really a good option or not.

[rhbirkelund]

Just make sure you do not configure subnets on the LAN side of your spare MX, that is also being used on the uplink interface. Meaning, if your spare MX has 192.168.1.10/24 on its Interface, do not configure a vlan on the spare MX that uses 192.168.1.0/24.

[GIdenJoe]

Default behavior on any MX is NAT on the WAN which means all traffic behind the MX67 will be NAT'ed to the WAN IP of that MX.  Like others have pointed out.  You can't have the WAN interface of the MX67 have the same subnet/overlapping subnet from one of the VLANs that is behind it.  You can however have an overlapping subnet on a different interface on the MX95 since the WAN interface of the MX67 will not now about it.

[PhilipDAth]

I have had a customer do exactly this.  It was in their R&D section.

Every developer has an MX on their desk, and they are allowed admin access to their own test network, and can replicate whatever IP configuration and VLANs they want for testing software and devices.

Their MX's connect to a dedicated switch (not in their control), that connected to a dedicated VLAN on the upstream MX (also not under their control), to limit any damage they could do to the corporate network.